Network Logs Monitoring and Analysis CND Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A small company needs to collect logs from network devices (routers, switches, firewalls) and Windows servers into a central SIEM. The devices support syslog, and the servers support Windows Event Forwarding. The company has limited budget and no dedicated log-collection infrastructure. Which approach is most appropriate?

   • AConfigure syslog on the network devices to send logs directly to the SIEM, and install an agent on the Windows servers to forward events.
   • BUse SNMP traps from all devices and servers to send logs to the SIEM.
   • CDeploy a dedicated log-collection server that uses proprietary agents for every device and server.
   • DExport logs manually from each device and server daily and upload them to the SIEM.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   Management asks for a summary of security incidents detected in the last quarter. The SIEM has alert data and incident tickets. What is the best way to produce this summary?

   • AGenerate a report from the SIEM that correlates alerts with incident tickets and includes metrics like time-to-detect and time-to-respond.
   • BManually count alerts from the SIEM dashboard.
   • CAsk each analyst to write a paragraph about what they worked on.
   • DExport all alerts to a spreadsheet and send it to management.
   Reveal Solution Discussion Select an answer first